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Listing of Claims: 

1. - 7. (Canceled) 

8. (Previously Presented) A method for transmitting data between a fail safe 
computer and a plurality of input/output modules via a bus control unit, said bus control 
unit being connected to said plurality of input/output modules via a serial bus and being 
connected to the fail safe computer, comprising cyclically carrying out following steps: 

transmitting, via the bus control unit, a first address over the serial bus for 
addressing one of the input/output modules; 

transmitting, via the bus control unit, a first multi-bit message over the serial bus 
to the input/output module addressed by the first address, the first multi-bit message 
including at least one first check bit and at least one first load bit; 

receiving, at the input/output module addressed by the first address, the first 
multi-bit message; and 

accepting, at the input/output module addressed by said first address, the first 
multi-bit message as correct only if the at least one first check bit is different from a 
corresponding first check bit included in a previous first multi-bit message received by 
the input/output module when addressed by the first address. 

9. (Previously Presented) A method according to claim 8, wherein the 
addressed input/output module additionally executes, the steps of: 

resetting a timer belonging to the addressed input/output module, if and only if 
said at least first one check bit is different from the corresponding first check bit included 
in the previous first multi-bit message received by this input/output module when 
addressed by the first address, 

switching an output of the addressed input/output module to a secure condition 
when said timer has run out; and 
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determining a state of the output according to the at least one first load bit as 

long as the timer has not run out. 

10. (Previously Presented) A method according to claim 8, further comprising 
the steps of: 

transmitting, via the bus control unit, a second address over the serial bus for 
addressing the input/output module already addressed by the first address also by the 
second address; 

transmitting, via the bus control unit, a second multi-bit message over the serial 
bus to the input/output module addressed by the second address, the second multi-bit 
message including at least one second check bit and at least one second load bit; 

receiving, at the input/output module addressed by the second address, the 
second multi-bit message; and 

accepting, at the input/output module addressed by the second address, the 
second multi-bit message as correct only if the at least one second check bit is different 
from a corresponding second check bit included in a previous second multi-bit message 
transmitted to the input/output module when addressed by the second address. 

11. (Previously Presented) A method according to claim 10, further comprising 
the steps of: 

comparing, at the input/output module addressed by the first and second 
addresses, the first and second multi-bit messages; and 

accepting, at the input/output module addressed by the first and second 
addresses, the first and second multi-bit messages as correct only if said first and 
second multi-bit messages correspond to each other. 

12. (Previously Presented) A method according to claim 8, wherein the number 
of first load bits is at least four. 
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13. (Previously Presented) A method according to claim 9, wherein the number 
of first load bits is at least four. 

14. (Previously Presented) A method according to claim 10, wherein the 
number of first load bits is at least four. 

15. (Previously Presented) A method according to claim 1 1 , wherein the 
number of first load bits is at least four. 
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